Skip to content

Commit f7e5add

Browse files
Vincent056Vincent056
committed
Add scannerType field, CustomRule CRD, and 'enabledCustomRule' fields
- Introduce scannerType to ComplianceScan and ComplianceSuite for specifying OpenSCAP or CEL. - Add custom rule CRD (compliance.openshift.io_customrules.yaml) and types. - Extend TailoredProfile with addtional EnableCustomRule field.
1 parent d9c72a3 commit f7e5add

18 files changed

+702
-3
lines changed

‎bundle/manifests/compliance-operator.clusterserviceversion.yaml

+3
Original file line numberDiff line numberDiff line change
@@ -205,6 +205,9 @@ spec:
205205
kind: ComplianceSuite
206206
name: compliancesuites.compliance.openshift.io
207207
version: v1alpha1
208+
- kind: CustomRule
209+
name: customrules.compliance.openshift.io
210+
version: v1alpha1
208211
- description: ProfileBundle is the Schema for the profilebundles API
209212
displayName: Profile Bundle
210213
kind: ProfileBundle

‎bundle/manifests/compliance.openshift.io_compliancescans.yaml

+4
Original file line numberDiff line numberDiff line change
@@ -266,6 +266,10 @@ spec:
266266
default: Node
267267
description: The type of Compliance scan.
268268
type: string
269+
scannerType:
270+
default: OpenSCAP
271+
description: The scanner used to perform the scan.
272+
type: string
269273
showNotApplicable:
270274
default: false
271275
description: Determines whether to hide or show results that are not

‎bundle/manifests/compliance.openshift.io_compliancesuites.yaml

+4
Original file line numberDiff line numberDiff line change
@@ -285,6 +285,10 @@ spec:
285285
default: Node
286286
description: The type of Compliance scan.
287287
type: string
288+
scannerType:
289+
default: OpenSCAP
290+
description: The scanner used to perform the scan.
291+
type: string
288292
showNotApplicable:
289293
default: false
290294
description: Determines whether to hide or show results that

‎bundle/manifests/compliance.openshift.io_customrules.yaml

+139
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,139 @@
1+
apiVersion: apiextensions.k8s.io/v1
2+
kind: CustomResourceDefinition
3+
metadata:
4+
annotations:
5+
controller-gen.kubebuilder.io/version: v0.17.1
6+
creationTimestamp: null
7+
name: customrules.compliance.openshift.io
8+
spec:
9+
group: compliance.openshift.io
10+
names:
11+
kind: CustomRule
12+
listKind: CustomRuleList
13+
plural: customrules
14+
singular: customrule
15+
scope: Namespaced
16+
versions:
17+
- name: v1alpha1
18+
schema:
19+
openAPIV3Schema:
20+
description: CustomRule is the Schema for the customrules API
21+
properties:
22+
apiVersion:
23+
description: |-
24+
APIVersion defines the versioned schema of this representation of an object.
25+
Servers should convert recognized schemas to the latest internal value, and
26+
may reject unrecognized values.
27+
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
28+
type: string
29+
kind:
30+
description: |-
31+
Kind is a string value representing the REST resource this object represents.
32+
Servers may infer this from the endpoint the client submits requests to.
33+
Cannot be updated.
34+
In CamelCase.
35+
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
36+
type: string
37+
metadata:
38+
type: object
39+
spec:
40+
properties:
41+
description:
42+
description: The description of the Rule
43+
type: string
44+
evaluation:
45+
properties:
46+
cel:
47+
description: CEL Evaluation
48+
properties:
49+
errorMessage:
50+
description: ErrorMessage is displayed when the rule evaluation
51+
fails
52+
minLength: 1
53+
type: string
54+
expression:
55+
description: Expression is the CEL expression to evaluate
56+
minLength: 1
57+
type: string
58+
inputs:
59+
description: Inputs defines the Kubernetes resources that
60+
need to be fetched before evaluating the expression
61+
items:
62+
nullable: true
63+
properties:
64+
apiGroup:
65+
description: APIGroup is the Kubernetes API group of
66+
the resource
67+
type: string
68+
name:
69+
description: Name is the variable name used to reference
70+
this resource in the CEL expression
71+
minLength: 1
72+
type: string
73+
namespace:
74+
description: Namespace is the Kubernetes namespace of
75+
the resource
76+
type: string
77+
resource:
78+
description: Resource is the Kubernetes resource type
79+
minLength: 1
80+
type: string
81+
type:
82+
enum:
83+
- KubeGroupVersionResource
84+
type: string
85+
version:
86+
description: Version is the Kubernetes API version of
87+
the resource
88+
minLength: 1
89+
type: string
90+
required:
91+
- apiGroup
92+
- name
93+
- resource
94+
- type
95+
- version
96+
type: object
97+
minItems: 1
98+
type: array
99+
required:
100+
- errorMessage
101+
- expression
102+
- inputs
103+
type: object
104+
type: object
105+
id:
106+
description: The ID of the Rule
107+
type: string
108+
instructions:
109+
description: Instructions for auditing this specific rule
110+
type: string
111+
rationale:
112+
description: The rationale of the Rule
113+
type: string
114+
severity:
115+
description: The severity level
116+
type: string
117+
title:
118+
description: The title of the Rule
119+
type: string
120+
warning:
121+
description: A discretionary warning about the of the Rule
122+
type: string
123+
required:
124+
- evaluation
125+
- id
126+
- title
127+
type: object
128+
status:
129+
description: Status is intentionally left empty.
130+
type: object
131+
type: object
132+
served: true
133+
storage: true
134+
status:
135+
acceptedNames:
136+
kind: ""
137+
plural: ""
138+
conditions: null
139+
storedVersions: null

‎bundle/manifests/compliance.openshift.io_rules.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,7 @@ spec:
5959
description: The description of the Rule
6060
type: string
6161
id:
62-
description: The XCCDF ID
62+
description: The ID of the Rule
6363
type: string
6464
instructions:
6565
description: Instructions for auditing this specific rule

‎bundle/manifests/compliance.openshift.io_tailoredprofiles.yaml

+18
Original file line numberDiff line numberDiff line change
@@ -69,6 +69,24 @@ spec:
6969
type: object
7070
nullable: true
7171
type: array
72+
enableCustomRules:
73+
description: Enables the referenced custom rules
74+
items:
75+
description: CustomRuleReferenceSpec specifies a customRule to be
76+
selected, as well as the reason why
77+
properties:
78+
name:
79+
description: Name of the customRule that's being referenced
80+
type: string
81+
rationale:
82+
description: Rationale of why this customRule is being selected
83+
type: string
84+
required:
85+
- name
86+
- rationale
87+
type: object
88+
nullable: true
89+
type: array
7290
enableRules:
7391
description: Enables the referenced rules
7492
items:

‎config/crd/bases/compliance.openshift.io_compliancescans.yaml

+4
Original file line numberDiff line numberDiff line change
@@ -266,6 +266,10 @@ spec:
266266
default: Node
267267
description: The type of Compliance scan.
268268
type: string
269+
scannerType:
270+
default: OpenSCAP
271+
description: The scanner used to perform the scan.
272+
type: string
269273
showNotApplicable:
270274
default: false
271275
description: Determines whether to hide or show results that are not

‎config/crd/bases/compliance.openshift.io_compliancesuites.yaml

+4
Original file line numberDiff line numberDiff line change
@@ -285,6 +285,10 @@ spec:
285285
default: Node
286286
description: The type of Compliance scan.
287287
type: string
288+
scannerType:
289+
default: OpenSCAP
290+
description: The scanner used to perform the scan.
291+
type: string
288292
showNotApplicable:
289293
default: false
290294
description: Determines whether to hide or show results that

‎config/crd/bases/compliance.openshift.io_customrules.yaml

+133
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,133 @@
1+
---
2+
apiVersion: apiextensions.k8s.io/v1
3+
kind: CustomResourceDefinition
4+
metadata:
5+
annotations:
6+
controller-gen.kubebuilder.io/version: v0.17.1
7+
name: customrules.compliance.openshift.io
8+
spec:
9+
group: compliance.openshift.io
10+
names:
11+
kind: CustomRule
12+
listKind: CustomRuleList
13+
plural: customrules
14+
singular: customrule
15+
scope: Namespaced
16+
versions:
17+
- name: v1alpha1
18+
schema:
19+
openAPIV3Schema:
20+
description: CustomRule is the Schema for the customrules API
21+
properties:
22+
apiVersion:
23+
description: |-
24+
APIVersion defines the versioned schema of this representation of an object.
25+
Servers should convert recognized schemas to the latest internal value, and
26+
may reject unrecognized values.
27+
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
28+
type: string
29+
kind:
30+
description: |-
31+
Kind is a string value representing the REST resource this object represents.
32+
Servers may infer this from the endpoint the client submits requests to.
33+
Cannot be updated.
34+
In CamelCase.
35+
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
36+
type: string
37+
metadata:
38+
type: object
39+
spec:
40+
properties:
41+
description:
42+
description: The description of the Rule
43+
type: string
44+
evaluation:
45+
properties:
46+
cel:
47+
description: CEL Evaluation
48+
properties:
49+
errorMessage:
50+
description: ErrorMessage is displayed when the rule evaluation
51+
fails
52+
minLength: 1
53+
type: string
54+
expression:
55+
description: Expression is the CEL expression to evaluate
56+
minLength: 1
57+
type: string
58+
inputs:
59+
description: Inputs defines the Kubernetes resources that
60+
need to be fetched before evaluating the expression
61+
items:
62+
nullable: true
63+
properties:
64+
apiGroup:
65+
description: APIGroup is the Kubernetes API group of
66+
the resource
67+
type: string
68+
name:
69+
description: Name is the variable name used to reference
70+
this resource in the CEL expression
71+
minLength: 1
72+
type: string
73+
namespace:
74+
description: Namespace is the Kubernetes namespace of
75+
the resource
76+
type: string
77+
resource:
78+
description: Resource is the Kubernetes resource type
79+
minLength: 1
80+
type: string
81+
type:
82+
enum:
83+
- KubeGroupVersionResource
84+
type: string
85+
version:
86+
description: Version is the Kubernetes API version of
87+
the resource
88+
minLength: 1
89+
type: string
90+
required:
91+
- apiGroup
92+
- name
93+
- resource
94+
- type
95+
- version
96+
type: object
97+
minItems: 1
98+
type: array
99+
required:
100+
- errorMessage
101+
- expression
102+
- inputs
103+
type: object
104+
type: object
105+
id:
106+
description: The ID of the Rule
107+
type: string
108+
instructions:
109+
description: Instructions for auditing this specific rule
110+
type: string
111+
rationale:
112+
description: The rationale of the Rule
113+
type: string
114+
severity:
115+
description: The severity level
116+
type: string
117+
title:
118+
description: The title of the Rule
119+
type: string
120+
warning:
121+
description: A discretionary warning about the of the Rule
122+
type: string
123+
required:
124+
- evaluation
125+
- id
126+
- title
127+
type: object
128+
status:
129+
description: Status is intentionally left empty.
130+
type: object
131+
type: object
132+
served: true
133+
storage: true

‎config/crd/bases/compliance.openshift.io_rules.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,7 @@ spec:
5959
description: The description of the Rule
6060
type: string
6161
id:
62-
description: The XCCDF ID
62+
description: The ID of the Rule
6363
type: string
6464
instructions:
6565
description: Instructions for auditing this specific rule

‎config/crd/bases/compliance.openshift.io_tailoredprofiles.yaml

+18
Original file line numberDiff line numberDiff line change
@@ -69,6 +69,24 @@ spec:
6969
type: object
7070
nullable: true
7171
type: array
72+
enableCustomRules:
73+
description: Enables the referenced custom rules
74+
items:
75+
description: CustomRuleReferenceSpec specifies a customRule to be
76+
selected, as well as the reason why
77+
properties:
78+
name:
79+
description: Name of the customRule that's being referenced
80+
type: string
81+
rationale:
82+
description: Rationale of why this customRule is being selected
83+
type: string
84+
required:
85+
- name
86+
- rationale
87+
type: object
88+
nullable: true
89+
type: array
7290
enableRules:
7391
description: Enables the referenced rules
7492
items:

0 commit comments

Comments
 (0)